CVE-2024-8248: Mintplexlabs Anythingllm Path Traversal

CVE-2024-8248 Overview

CVE-2024-8248 is a path traversal vulnerability in mintplex-labs/anything-llm, an open-source large language model (LLM) application framework. The flaw resides in the normalizePath function, which fails to properly constrain file paths to the intended storage directory. An authenticated attacker with manager-level privileges can read and write arbitrary files inside the storage directory, enabling privilege escalation from manager to administrator. The vulnerability is tracked as [CWE-29: Path Traversal: \..\filename] and was fixed in AnythingLLM version 1.2.2. It affects git revision 296f041 and earlier builds prior to the patch.

Critical Impact
Authenticated manager accounts can traverse outside the intended storage directory, overwrite sensitive files, and escalate privileges to administrator.

Affected Products

Mintplex Labs AnythingLLM (git revision 296f041)
AnythingLLM versions prior to 1.2.2
Self-hosted and Docker deployments of AnythingLLM

Discovery Timeline

2025-03-20 - CVE-2024-8248 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8248

Vulnerability Analysis

The vulnerability affects the file-move functionality exposed by the AnythingLLM API. The server accepts user-supplied from and to parameters that are joined to the internal documentsPath using path.join after calling normalizePath. Because normalizePath does not reject traversal sequences that resolve outside the storage root, an attacker can supply crafted values that escape the intended directory.

Manager-level users can therefore move files into or out of paths reserved for administrator-only resources. This includes overwriting workspace configuration and system files that back administrative state, providing a direct path from the manager role to the administrator role.

The issue is categorized as path traversal ([CWE-29]) and requires authentication with existing manager privileges. Exploitation does not require user interaction and is reachable over the network wherever the AnythingLLM API is exposed.

Root Cause

The root cause is a missing containment check after path normalization. normalizePath sanitizes the string form of the path but does not verify that the resolved absolute path remains within documentsPath. Any input using .. segments, absolute paths, or symbolic references can bypass the intended boundary.

Attack Vector

An authenticated manager sends a request to the document move endpoint with from or to values containing traversal sequences. The server resolves these into paths outside documentsPath and performs fs.rename on them, resulting in arbitrary file read and write inside the storage subsystem.

javascript

// Patched code in server/endpoints/api/document/index.js
// Source: https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7
const sourcePath = path.join(documentsPath, normalizePath(from));
const destinationPath = path.join(documentsPath, normalizePath(to));
return new Promise((resolve, reject) => {
  if (
    !isWithin(documentsPath, sourcePath) ||
    !isWithin(documentsPath, destinationPath)
  )
    return reject("Invalid file location");

  fs.rename(sourcePath, destinationPath, (err) => {
    if (err) {
      console.error(`Error moving file ${from} to ${to}:`, err);
    }
  });
});

The patch introduces the isWithin helper to verify that both sourcePath and destinationPath resolve inside documentsPath before invoking fs.rename.

Detection Methods for CVE-2024-8248

Indicators of Compromise

API requests to the document move endpoint containing .., %2e%2e, or absolute path prefixes in from or to parameters.
Unexpected file creation, deletion, or renaming outside the AnythingLLM documents storage directory.
Manager-level accounts performing actions that subsequently register as administrator activity in application logs.
Modifications to workspace configuration files or database-backed state without a corresponding administrator session.

Detection Strategies

Inspect AnythingLLM application logs for Error moving file entries referencing paths containing traversal characters.
Monitor HTTP traffic to /api/document endpoints for parameter values that decode to paths outside the storage root.
Correlate role changes and workspace ownership transitions with the identity of the acting user, flagging escalations that lack a legitimate administrator origin.

Monitoring Recommendations

Enable file integrity monitoring on the AnythingLLM storage directory and adjacent configuration paths.
Ship AnythingLLM container and application logs to a centralized logging backend for retention and query.
Alert on any file system rename operations initiated by the AnythingLLM process outside its documented storage tree.

How to Mitigate CVE-2024-8248

Immediate Actions Required

Upgrade AnythingLLM to version 1.2.2 or later, which introduces the isWithin containment check.
Audit existing user accounts and revoke unnecessary manager-level privileges until the upgrade is complete.
Review recent document move operations for signs of traversal abuse and verify that no unauthorized administrator accounts exist.
Rotate API keys and session tokens for any workspace that granted manager access before patching.

Patch Information

The vendor patch is available in commit 47a5c71 and is included in AnythingLLM release 1.2.2. Additional technical context is available in the Huntr Bounty Report. The patch validates that both source and destination paths remain within documentsPath before executing fs.rename.

Workarounds

Restrict AnythingLLM API access to trusted networks using a reverse proxy or firewall until the patch is applied.
Limit manager role assignments to the minimum required set of accounts, since exploitation requires manager privileges.
Run AnythingLLM in an isolated container with a dedicated volume for documentsPath and no write access to host configuration files.

bash

# Verify installed AnythingLLM version and upgrade via Docker
docker inspect mintplexlabs/anythingllm --format '{{.Config.Labels.version}}'
docker pull mintplexlabs/anythingllm:1.2.2
docker stop anythingllm && docker rm anythingllm
docker run -d --name anythingllm \
  -v /opt/anythingllm/storage:/app/server/storage \
  -p 3001:3001 mintplexlabs/anythingllm:1.2.2